AOMEI Backupper Update Servers Hijacked to Distribute Malware
Attackers compromised AOMEI's update servers for its popular Backupper software, briefly pushing malware to users worldwide.
Attackers successfully compromised the update and notification infrastructure of AOMEI Technology, a company known for its popular backup software, AOMEI Backupper. This campaign, which researchers investigated between April and July, saw threat actors briefly alter the software's update mechanisms to deliver malware to unsuspecting users. AOMEI Backupper is a widely used tool, with the company reporting over 100 million users globally who rely on it for file backups, drive cloning, and data recovery.
The attackers exploited the same update system that also serves AnyViewer customers, though confirmed infections specifically targeting AnyViewer users were not detailed in the report. During specific, short windows of time, the threat actors modified the software's update instructions and version checks. They manipulated the remote configuration file, which dictates both the download source and the expected checksum, to point to a malicious ZIP archive and present a false version number and MD5 checksum. This allowed the client software to accept the malicious payload as legitimate.
Researchers identified three distinct tampering windows, lasting ten, six, and five minutes respectively, though it is possible that additional, shorter periods of compromise occurred. These brief attack windows, while limiting the potential scale of infection, also made the malicious activity more difficult to detect. The primary goal of the attack was to install a persistent remote-access backdoor onto user systems.
The delivered malware functioned as an initial downloader, which then established a backdoor, granting attackers the ability to execute commands and deploy further malicious software. While the specific malware was not identified as ransomware or an infostealer, the presence of a persistent backdoor leaves infected machines vulnerable to subsequent attacks and deeper compromise. This could allow attackers to maintain long-term access or pivot to other systems within a compromised network.
Users who utilized AOMEI Backupper during the affected period are advised to update their security software and perform a thorough scan. Malwarebytes' AI detection engine was able to identify the initial downloader, named upgrade-now.exe, as Malware.AI.4006642887, providing protection for its customers through real-time detection.
Beyond running security scans, users can look for additional warning signs within their Windows system. These include the presence of a scheduled task named RadminComponentRuntime in the Windows Task Scheduler, or the appearance of an unsigned upgrade-now.exe or an unexpected upgrade-now.zip file within the AOMEI Backupper installation directory's version-specific folders. However, the absence of the downloader does not guarantee a system is clean, as it is designed to self-delete after staging the next payload and establishing persistence.
Suspicious network activity is another indicator, particularly outgoing traffic to domains such as promotion.storage-data.com, aomei.storage-data.com, storage-data.com, or specific IP addresses like 8.210.84.56, 47.239.60.117, or 8.218.65.184. If any of these signs are detected, users are strongly recommended to seek assistance from a trusted computer technician, Malwarebytes Support, or their organization's IT/security team rather than attempting manual remediation. Disconnecting the affected PC from the internet is advised if active compromise is suspected.